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REMARKS 

This Response is filed in reply to the Office Action dated April 24, 2008. Claims 
1-54 are pending all of which are rejected. In this Response no claims are amended or 
cancelled and no new claims are added. Accordingly, claims 1-54 remain pending in the 
application, of which claims 1, 21, 30 and 39 are independent. 

Silence with regard to any of the Examiner's rejections is not acquiescence to 
such rejections, but rather a recognition by Applicants that such previously lodged 
rejection is moot based on Applicants' remarks and/or amendments. Specifically, silence 
with regard to Examiner's rejection of a dependent claim, when such claim depends from 
an independent claim that Applicants consider allowable for reasons provided herein, is 
not an acquiescence to such rejection of the dependent claim, but rather a recognition by 
Applicants that such previously lodged rejection is moot based on Applicants' remarks 
and/or amendments relative to the independent claim (that Applicants consider allowable) 
from which the dependent claim depends. Furthermore, any cancellations of and 
amendments to the claims are being made solely to expedite prosecution of the instant 
application. Applicants reserve the option to further prosecute the same or similar claims 
in the instant or a subsequent application. 

Claim Rejections Under 35 U.S.C. §102 J 2 

Claims 2-17, 22, 25-29, 31, 34-38, 40 and 44-51 stand rejected under 35 U.S.C. 
§102 f2, the Examiner taking the position that it is inconsistent for claim 1 to recite that a 
function is applied to a requested address to obtain a return address while the rejected 
dependent claims recite that the function comprises an action using some other value 
such as, for example, hashing a user address (claim 2, 31), time (claim 7) or both (claim 
22, 40), changing a used one of the block of addresses over time (claims 8, 25, 34, 44). 
However, for the reasons presented, the limitations are not inconsistent and do not render 
the rejected claim indefinite. Accordingly, the rejection is respectfully traversed. 

As described in the specification: 
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[0025] The use of dark space and requestor-specific address resolution can 
assist in detecting attempts at malicious or unauthorized access to network 
102 or resources 106 on network 102. Referring more particularly to Fig. 
2, method 200 can begin at 202 when a request is made for an address, for 
example from a DNS. Rather than associating a single IP address with a 
resource 106, system 100 can provision a large block of IP addresses such 
as a /24 or 256 IP addresses. As an example using standard IP prefix 
notation, "41.5.63.0" can signify an address for a resource 106, referred to 
hereafter as the requested address, and "41.5.63.0/24" can signify the 
block of 256 addresses for that resource 106. 

Specification at page 9, lines 1-8. 

Thus, a least one independent value used in determining a return address is the 
address requested from a user. Claim 1 describes this as: 

applying a function to said address to obtain a return address, said return 
address corresponding to a used one of a block of addresses; 



To define a specific address the function may include more as provided by the 
open-ended "comprising" language of, for example, rejected claim 2: 

2. The method according to claim 1, wherein applying said function 
comprises hashing a user address of said user to obtain one value of a range of 
values mapping to said block of addresses, said one value designating said used 
one of said block of addresses. 



That is, as recited by claim 2, the function includes hashing a user address to 
obtain a value. This value may be dependent on both (i) the requested address and (ii) a 
hash of the user address. There is nothing inconsistent with a function using two 
independent values to provide a return address. 

Since, for the reasons presented, the language of the rejected claims is not 
inconsistent with that of the respective base claims, the rejection under 35 U.S.C. § 1 12, 
second paragraph, is improper and withdrawal thereof is respectfully requested. 
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Claim Rejections Under §103 

Claims 1,8-11,13-21, 23-26, 28-30, 32-35, 37-39, 41-45 and 47-54 stand rejected 
under 35 U.S.C. §.1 03(a) as being unpatentable over Network Working Group RFC 2131 
of R. Droms ("Droms") in view of Liston, U.S. Patent Publication No. 20040103314. 

Claims 2-7, 22, 31 and 40 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable over "the modified" Droms and Liston further in view Hasty, Jr., et al, U.S. 
patent Publication No. 20030179750 ("Hasty"). 

Claims 12, 27, 36 and 46 stand rejected under 35 U.S.C. § 103(a) as being 
unpatentable "the modified" Droms, Liston and Hasty, further in view of Griffiths et al., 
U.S. Patent No. 6,286,045 ("Griffiths"). 

All rejections under 35 U.S.C. § 103(a) are respectfully traversed for failure of the 
cited references to teach or suggest the language of the rejected claims and for lack of any 
teaching, suggestion, or motivation for making the asserted combination. 

Addressing the primary reference of Droms that forms the basis of all outstanding 
rejections under 35 U.S.C. 103(a), the RFC describes Dynamic Host Configuration 
Protocol (DHCP): 

DHCP supports three mechanisms for IP address allocation. In 
"automatic allocation", DHCP assigns a permanent IP address to a client. 
In "dynamic allocation", DHCP assigns an IP address to a client for a 
limited period of time (or until the client explicitly relinquishes the 
address). In "manual allocation", a client's IP address is assigned by the 
network administrator, and DHCP is used simply to convey the assigned 
address to the client. 

Droms at page 3. 

The Examiner has taken the position that "checking that the network address is 
not already in use" is equivalent to the function of claim 1 . In support, the Examiner 
cites to Droms at section 3.1, number, which reads as follows: 

2. Each server may respond with a DHCPOFFER message that includes an 
available network address in the 'yiaddr 'field (and other configuration 
parameters in DHCP options). Servers need not reserve the offered network 
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address, although the protocol will work more efficiently if the server avoids 
allocating the offered network address to another client. When allocating a 
new address, servers SHOULD check that the offered network address is not 
already in use; e.g., the server may probe the offered address with an ICMP 
Echo Request. Servers SHOULD be implemented so that network 
administrators MAY choose to disable probes of newly allocated addresses. 
The server transmits the DHCPOFFER message to the client, using the 
BOOTP relay agent if necessary. 

Droms at pages 12-13. 

That is, the server responds to a DHCPDISCOVER - a message broadcast by a 
client to locate available servers, using a DHCOFFER message, a message from the 
server to the client with an offer of configuration parameters including an available 
network address. However, there is no suggestion that the available network address is a 
function of a requested address as the term "function" would be understood in the context 
of the present claims. That is, while a device according to Droms may "function", that is 
operate, to provide an available network address, that is not equivalent to "applying a 
function to said address to obtain a return address". Citing again to Applicants' 
disclosure: 

As an example using standard IP prefix notation, "41.5.63.0" can signify 
an address for a resource 106, referred to hereafter as the requested 
address, and "41.5.63.0/24" can signify the block of 256 addresses for that 
resource 106. 

Specification at page 9, lines 6-8. 

As in the example, the claimed return address is a function of the requested 
address. According to some of the dependent claims, the return address may further be a 
function (e.g., a hash) of a user address or a time "to obtain one value of a range of values 
mapping to said block of addresses" (claim 2). Droms fails to describe or suggest 
applying a function to a received address to obtain a return address and therefore fails to 
render obvious the rejected claims. 

The rejections under 35 U.S.C. § 103(a) are further considered to be improper for 
lack of any teaching, suggestion, or motivation for making the asserted combination. 
Absent such basis for combining or modifying the teachings of the prior art to produce 
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the claimed invention the rejection is improper. In re Kahn, 441 F.3d 977, 986, 78 
USPQ2d 1329, 1335 (Fed. Cir. 2006) (discussing rationale underlying the motivation- 
suggestion-teaching test as a guard against using hindsight in an obviousness analysis). 
Further, if, as here, the proposed modification would render the prior art invention being 
modified unsatisfactory for its intended purpose, then there is no suggestion or 
motivation to make the proposed modification. MPEP § 2143.01(V) citing In re Gordon, 
733 F.2d 900, 221 USPQ 1 125 (Fed. Cir. 1984). 

The primary Droms reference is directed to defining a client-server protocol that 
provides a requestor with "an available network address". Thus it would appear that 
implementing the protocol taught by Droms would result in the return of a valid address. 
The Examiner applies Liston for detecting unauthorized attempts to access a resource 
when the request corresponds to an unused address. However, since Droms returns an 
available network address, this functionality would appear to defeat the functionality 
taught by Liston to monitor for addresses directed toward unused Interntet protocol 
addresses within a computer network. Alternatively, if "available network address" 
supplied according to Droms is considered equivalent to an unused address, then 
combining Droms and Liston would result in all accesses being identified as 
unauthorized. In either case, the functionality described by Droms of providing an 
available address defeats the intrusion detection of Liston, rendering it inoperative for its 
intended purpose. Accordingly the combination under 35 U.S.C. § 103(a) is improper. 

The rejection is additionally improper for lack of any suggestion to make the 
asserted combination. The mere fact that references can be combined or modified does 
not render the resultant combination obvious unless the results would have been 
predictable to one of ordinary skill in the art. MPEP § 2143.01(111) citing KSR 

International Co. v. Teleflex Inc., 550 U.S. , , 127 S. Ct. 1727, 82 USPQ2d 1385, 

1396 (2007). One skilled in the art would have no reason to modify an address scheme 
according to Droms as suggested by the Examiner absent impermissible hindsight 
derived from Applicants' disclosure. 
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The combination further fails to describe or suggest the subject matter of 
dependent claims 2, 4-6, 18-20, 23-24, 31-33, 40-43 and 52-54. For example, claims 2, 
22, 31 and 40 require hashing a user address to obtain one value of a range of values 
mapping to the block of addresses, the one value designating the used one of the block of 
addresses. Hasty describes the use of a deterministic hash function applied to a six byte 
MAC address to provide two bytes of the IP address unique to each node. Thus, as best 
understood, applying Hasty to Droms would result in a particular requested address 
always being assigned the same return address. In contrast, claim 2 requires that the hash 
be applied to the user's address (not the requested address) so that different return 
addresses are generated for a particular requested address. 

The addition of Griffiths fails to cure the defects inherent in the outstanding 
rejections. As before, there is no teaching, suggestion, or motivation for modifying 
Droms to include the intrusion prevention features taught by Liston, much less to include 
any additional teaching according to Griffiths. The rejections based on the addition of 
Liston are further improper as neither that patent nor the combination describe or suggest 
"hashing a time of [a] request" (claims 3 and 7), "changing said used one of said block 
addresses over time" (claims 8, 25, 34 and 44), "applying [a] function comprises 
determining a time period for changing said one of said block of addresses" (claim 9). 

The further modification of Droms in view of Liston and Hasty further in view of 
Griffiths et al. is not only improper but would not result in the claimed combination for 
the reasons previously set forth and for the following. Griffiths et al. describes randomly 
selecting an IP address to monitor a round trip time between a DNS server and an 
information server. This functionality has nothing to do with Droms, Liston or Hasty. 
There is no teaching, suggestion or motivation for making the combination other than 
hindsight reconstruction using Applicants' claim as a template. 

In summary, Applicants traverse the Examiner's rejections under 35 U.S.C. § 
103(a), and respectfully request reconsideration in view of the remarks herein. 
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CONCLUSION 

In view of the above, each of the presently pending claims in this application is 
believed to be in immediate condition for allowance. Accordingly, the Examiner is 
respectfully requested to enter the present amendment, withdraw all outstanding 
rejections, and pass this application to issue. 

Applicants believe no fee is due with this response. However, if any other 
extension of time under 37 C.F.R. §1.136 is required the petition is hereby made. 
Further, if any other or additional fee is due, please charge our Deposit Account No. 06- 
2375, under Order No. 414.094/10802357 from which the undersigned is authorized to 
draw and please credit any excess fees to such deposit account. 

Dated: July 10, 2008 Respectfully submitted 
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